@pixelmatters/markup 1.34.2 → 1.34.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -6
- package/dist/widget.js +8 -8
- package/dist/widget.js.map +1 -1
- package/package.json +1 -1
- package/skills/install-markup-widget/SKILL.md +4 -4
package/package.json
CHANGED
|
@@ -7,7 +7,7 @@ sources:
|
|
|
7
7
|
- 'Pixelmatters/markup:packages/widget/src/widget.ts'
|
|
8
8
|
metadata:
|
|
9
9
|
library: pixelmatters-markup
|
|
10
|
-
library_version: '1.34.
|
|
10
|
+
library_version: '1.34.3'
|
|
11
11
|
---
|
|
12
12
|
|
|
13
13
|
`@pixelmatters/markup` is a Preact widget that runs inside a shadow DOM and talks to a hosted Convex backend at `https://<deployment>.convex.site`. The host page calls `init({ apiUrl, apiKey })` once at the app root and gets back a `destroy()` function. Everything else lives inside the widget bundle: pin anchoring, threads, mentions, identity, screenshots, real-time updates.
|
|
@@ -26,7 +26,7 @@ For a `<script>`-tag drop-in (no bundler / CMS / page-builder), use the inline E
|
|
|
26
26
|
|
|
27
27
|
```html
|
|
28
28
|
<script type="module">
|
|
29
|
-
import { init } from 'https://esm.sh/@pixelmatters/markup@1.34.
|
|
29
|
+
import { init } from 'https://esm.sh/@pixelmatters/markup@1.34.3'
|
|
30
30
|
init({ apiUrl: '…', apiKey: '…' })
|
|
31
31
|
</script>
|
|
32
32
|
```
|
|
@@ -36,7 +36,7 @@ If the host disallows inline JS, use the auto-init form. `data-markup-widget="tr
|
|
|
36
36
|
```html
|
|
37
37
|
<script
|
|
38
38
|
type="module"
|
|
39
|
-
src="https://esm.sh/@pixelmatters/markup@1.34.
|
|
39
|
+
src="https://esm.sh/@pixelmatters/markup@1.34.3"
|
|
40
40
|
data-markup-widget="true"
|
|
41
41
|
data-api-url="…"
|
|
42
42
|
data-api-key="…"
|
|
@@ -216,7 +216,7 @@ Walk these in order when the widget is misbehaving:
|
|
|
216
216
|
- **Don't wrap in a provider component.** `init` is the whole public API.
|
|
217
217
|
- **Don't call `init` inside a route component.** Mount at the app root once.
|
|
218
218
|
- **Don't hardcode the API key.** Use env vars so rotations don't require a code change.
|
|
219
|
-
- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.34.
|
|
219
|
+
- **Don't ship CDN URLs without a version pin.** `@pixelmatters/markup@1.34.3`, not `@pixelmatters/markup`.
|
|
220
220
|
- **Don't add `https://*.convex.site` to `connect-src` and assume that's the whole CSP story.** The deployment domain (`<your-deployment>.convex.site`) is what the widget hits over HTTP, and it must be listed explicitly. Live thread updates go to `wss://<your-deployment>.convex.cloud`, an origin the widget derives from `apiUrl`, so `connect-src` needs both. `img-src` needs `blob:`, `data:`, and the host serving profile pictures; `style-src` needs `'unsafe-inline'` only for Safari before 16.4 and Firefox before 101, where the widget falls back to a `<style>` element inside its shadow root; everywhere else it adopts a constructed stylesheet, which CSP doesn't block. Add `https://esm.sh` to `script-src` only if you took the CDN path.
|
|
221
221
|
|
|
222
222
|
## Versioning & releases
|